#520 Issue
Sept. 14, 2026
Welcome to issue #519 September 7th, 2026
News
BigQueryData AnalyticsOfficial BlogBigQuery Graph is now GA: the knowledge foundation for the agentic era - Discover how BigQuery Graph enables native graph analytics and AI agent grounding, delivering connected context across enterprise data without moving data.
BigQueryData AnalyticsMachine LearningOfficial BlogIntroducing TabFM in BigQuery: Predictive analytics reimagined - TabFM in BigQuery uses in-context learning (ICL) to deliver highly accurate predictions on your tabular datasets via a single SQL statement.
BigQueryData AnalyticsOfficial BlogSimplify pipelines with new BigQuery identity columns - New BigQuery identity columns let you define columns that automatically generate sequential 64-bit integer values to manage’ unique identifiers.
ADKGeminiKotlinOfficial BlogAnnouncing the Google Gen AI SDK for Kotlin 1.0: Idiomatic multiplatform access to Gemini - Google has announced the 1.0 release of the Google Gen AI SDK for Kotlin, a multiplatform library designed to bring idiomatic Gemini integration to both Android and JVM developers.
Official BlogQuadrantGoogle named a Leader in 2026 Gartner® Magic Quadrant™ for Strategic Cloud Platform Services - For the ninth consecutive year, Gartner® has named Google a Leader in the Gartner Magic Quadrant™ for Strategic Cloud Platform Services, positioned furthest for Completeness of Vision.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
IAMHuman, Machine, Agent: The Three Identity Kinds on Google Cloud - The article explores the evolution of identity management on Google Cloud, introducing a necessary third category known as Agent Identity to accompany traditional human and machine identities.
CISO Official Blog Public SectorCloud CISO Perspectives: Tips on securing the water sector in the AI era - Chris Sistrunk and Stephanie Kiel detail the critical issues facing the water sector, and actionable steps that OT operators can take to secure infrastructure.
Official Blog Threat IntelligenceFinancially Motivated Threat Actor BREEZE COMET Targets Brazil - Mandiant details the threat actor BREEZE COMET's tactics and toolkit targeting Brazilian financial services, and provides mitigation recommendations to defend against the threat.
Networking Official Blog VPC Service ControlsHow Blackline simplifies perimeter policy intelligence with VPC Service Controls - We’re excited to share new policy intelligence capabilities in VPC-SC that help drive operational simplicity: Violation analyzer and violation dashboard.
Google Kubernetes Engine KubernetesNever* Run Out of Compute: A Practical Guide to GKE Resource Obtainability - This article provides a practical guide on how to prevent resource shortages and ensure reliable compute obtainability when scaling workloads on Google Kubernetes Engine.
AI GPU KubernetesOSS — Kubernetes on GCE , DRA Driver for NVIDIA GPUs, DRANET (OSS) and NCCL test — AI Infra - This technical guide walks through setting up a high-performance, self-managed artificial intelligence infrastructure on Google Compute Engine using NVIDIA Blackwell B200 GPUs.
Infrastructure Networking PaywallCentralized Google API traffic Inspection with a Network Virtual Appliance (NVA) - This article provides a comprehensive, step-by-step guide on how to set up centralized traffic inspection for Google APIs within Google Cloud Platform using Private Service Connect and a Network Virtual Appliance.
DevOps KubernetesCompute Advisor: Plan GCP Compute Engine & GKE with Gemini - A new Gemini-powered tool that recommends machine types, costs, and configs for Compute Engine and GKE before you deploy.
IAM SecurityGoogle Cloud Security Readiness Check - An independent, technical self-assessment to evaluate your Google Cloud architecture against 29 hardened security baseline controls across 7 core domains — executed 100% client-side in your browser.
App Development, Serverless, Databases, DevOps
Analyzing Cloud Spanner Introspection Metrics Offline & Locally - Fast & local exploration of Spanner performance tables.
Antigravity Cloud Spanner Official BlogSpanner migrations: Automating dual-write with Antigravity CLI for minimal disruption - How an automated refactoring pipeline built with Antigravity CLI helped accelerate a Spanner database migration while maintaining data parity.
PythonOracle AI Database Connectivity With python-oracledb: Using Google Cloud Platform (GCP) - Use Google Cloud Storage and Google Cloud Secret Manager to manage Oracle AI Database connection configuration outside Python applications.
Cloud Run SecurityDeploy What Changed: Nx affected + Cloud Run + Workload Identity Federation - This article provides a comprehensive guide on building a secure and efficient CI/CD deployment pipeline for Google Cloud Run using an Nx monorepo and GitHub Actions.
Cloud Run Cloud WorkstationsRunning Code OSS on Cloud Run instances: What Works, What Breaks, and What I Learned - This article explores the capabilities and current limitations of Google Cloud Run instances through a practical experiment of running a containerized Code OSS development environment.
Cloud Build DevOps DockerStop rebuilding from scratch: cache Docker layers on Cloud Build - How BuildKit + Artifact Registry turn your CI/CD pipelines around: if nothing changed, uv doesn't re-download a single package.
FinOpsBridging the Gap Between Engineering and Finance: Talking directly to your AI-Driven GCP Billing - This article explores how organizations can bridge the communication gap between technical engineering teams and non-technical departments by implementing an AI-driven FinOps solution on Google Cloud Platform.
Cloud Firestore FirebaseAuthentication made easy: Building a secure e-commerce shopping cart with Firebase - This article explores how to build a seamless e-commerce checkout experience using Firebase Authentication and Cloud Firestore by treating every site visitor as an authenticated anonymous user from the start.
Firebase3 ways to optimize Firebase Remote Config fetch usage - This article explains how to prepare for Firebase Remote Config’s transition to a usage-based billing model by optimizing your app's network requests. It outlines three best practices—such as adopting a "fetch for next session" pattern, using conditional smart fetching, and strategically managing real-time listeners—to reduce latency, save battery, and keep costs low.
Agents Cloud RunSafely Running Untrusted Code: A Hands-On Guide to Google Cloud Run Sandboxes - How to build a zero-trust execution plane for AI agents, code runners, and multi-tenant platforms, without heavy VMs.
Big Data, Analytics, ML&AI
Agents Airflow Data Analytics Official BlogFrom weeks to minutes: The new agentic era of data pipelines - Build, deploy, and troubleshoot Airflow pipelines in minutes using Google Cloud Data Agent Kit and natural language.
Apache IcebergSeven Iceberg REST Catalogs: What They Declare, and What They Serve - This article evaluates seven Apache Iceberg REST catalog implementations—including options from Google Cloud, AWS, Databricks, Snowflake, and Microsoft—by comparing their published specifications against actual API behavior.
BigQueryUnifying Google Workspace and Apache Iceberg: Serverless Lakehouse Management
BigQueryBigQuery Slot Contention Is an Architecture Problem, Not a Query Problem - How to diagnose queueing, workload contention, slot starvation and capacity bottlenecks before rewriting another SQL query.
BigQueryOptimizing Cost and Performance in BigQuery with Window Functions - Based on real funnel analysis scenarios from e-commerce and travel platforms.
BigQueryWhy that subquery in your WHERE clause might be scanning your whole table - This article explains why using an inline subquery in a BigQuery `WHERE` clause can accidentally disable partition pruning and cause your queries to scan an entire table.
Apache Beam Cloud DataflowLLM and Statistical Synthetic Data with Dataflow — Part 1: why, what, and the shape of the machine - This article explores an open-source architecture for generating realistic, statistically rigorous synthetic data using Apache Beam and Google Cloud Dataflow.
Agents Official BlogGetting started with Mantis, our open-source bug finding-and-fixing harness - Mantis is part of how Google finds and fixes vulnerabilities at machine-speed. The open-source AI harness creates a more effective repository analysis.
BigQuery Gemini Open Knowledge FormatWhat Your Schema Cannot Tell Your Agent, Open Knowledge Format Can - This article discusses the challenges of maintaining AI agent business logic in unstructured prompt strings and introduces Google's Open Knowledge Format (OKF) as a solution. By organizing domain definitions, database schemas, and business rules into version-controlled Markdown files with Git-based reviews, developers can significantly improve the accuracy and reliability of data-driven AI agents.
ADK AI TypescriptMulti-Agent Does Not Mean Parallel: Safe Workflows with Google ADK - This article explores how to build safe, reliable multi-agent AI systems using the Google Agent Development Kit (ADK) in TypeScript. It explains that parallel agent execution should only be used for gathering independent evidence rather than making concurrent state mutations.
Agents MCPYour Agent Doesn’t Know How to Wait - This article explores how different waiting patterns for long-running cloud operations drastically impact the token costs, efficiency, and performance of AI agents. It benchmarks three approaches—in-loop polling, server-side blocking, and harness-managed tasks—revealing that poor wait design can exponentially increase model expenses.
ADK AI TypescriptYour Google ADK Agent Has Four Places to Put Context. Choose Carefully. - When building AI agents in TypeScript using the Google Agent Development Kit, relying solely on the prompt for conversation history and data leads to costly, ungoverned applications. This article explores how to properly structure your agent's data by choosing between four distinct context homes: session events, working state, long-term memory, and versioned artifacts.
AI4 engineering patterns behind the strongest AI Agents Challenge submissions - The recent Google for Startups AI Agents Challenge revealed that the most successful multi-agent systems rely on foundational software engineering patterns rather than just raw model power. Winning architectures consistently implemented bidirectional MCP for seamless inter-agent communication, async event buses for parallel execution, strict unified validation for model fallbacks, and tiered routing to minimize expensive inference calls.
Cloud Dataproc Data Analytics Official Blog StreamingHow Yahoo optimizes resources with flexible VMs in Managed Service for Apache Spark - Learn how Yahoo uses flexible VMs in Managed Service for Apache Spark to automatically handle capacity limits and reduce provisioning failures by 85%.
Gemma Official Blog TPUNot All LLM Workloads Are Equal: Benchmarking TPU Performance on Classification vs. Generation - Benchmark Gemma 3 on Google Cloud TPU v6e. Find out why generation tasks hit a performance wall and how to optimize throughput with vLLM bucket padding.
Various
GCP CertificationAssociate Cloud Engineer — Practice Questions and Mock Exam - Pass-IT offers adaptive practice questions, answer explanations, and a readiness score for Google Cloud certification exams.
AIDriving Developer Excellence: Inside the Program Sprints - The Gemini Enterprise Developer Experience (DevEx) program conducts ongoing sprint testing of end-to-end developer workflows to identify and rapidly resolve friction points without relying on internal shortcuts. This recent sprint focused on optimizing enterprise AI governance, including refining setup prerequisites, securing extension configurations, and clarifying policy enforcement mechanics to ensure a smoother, more reliable deployment. Developers can now leverage updated documentation and standardized code samples to improve their experience with Agent Gateway and Semantic Governance configurations.
Slides, Videos, Audio
Kubernetes Podcast - #272 Agent Substrate, with Tim Hockin and Brandon Royal.
Releases
API Gateway - New model routing gateways might use a gateway.dev default hostname If you create a gateway that uses model routing on or after September 3, 2026, it might receive a gateway.dev default hostname instead of a run.app one, in the form https://GATEWAY_ID-PROJECT_NUMBER.REGION.gateway.dev — for example, https://my-gateway-123456789012.us-central1.gateway.dev. This is a second gateway.dev format; other gateways keep the existing one. To get a gateway's URL, read its defaultHostname property. For more information, see Deploy an API to a gateway.
AlloyDB - AlloyDB real-time data access to BigQuery (in Preview ) now offers limit pushdown and runtime projects: Limit pushdown: when you query foreign tables, some LIMIT and OFFSET clauses are automatically pushed down to BigQuery, reducing network transfer and improving query response times. For more information, see Access to real-time data in BigQuery overview. Runtime projects: you can specify an optional runtime project at either the foreign server or foreign table level to execute queries and manage compute costs independently of the project that stores your data. For more information, see Configure access to real-time data in BigQuery. Consider using least-privilege security controls to restrict foreign server usage. For more information, see Secure BigQuery data access using the foreign data wrapper.
Apigee UI - Bug ID Description 547582067 Revisions can now be imported for API proxies and shared flows in a space Importing a revision in the Apigee UI now works for an API proxy or shared flow that is associated with a space. Previously, the Apigee UI did not include the space when it uploaded the revision bundle, so the import request was rejected and the new revision was not created. This affected both API proxies and shared flows. The earlier workaround of removing the API proxy or shared flow from its space, importing the revision, and then adding it back to the space is no longer needed. On September 1, 2026, we released an updated version of the Apigee UI.
AppEngine Standard Go - Support for the Go 1.27 runtime is in General Availability (GA).
Backup and DR Service - Backup vault support for AlloyDB for PostgreSQL instances encrypted with customer-managed encryption keys (CMEK) is generally available (GA), providing immutable and indelible storage with enforced retention. For more information, see Encrypt AlloyDB for PostgreSQL cluster backups. Announcing the general availability (GA) of cross-region backups for AlloyDB for PostgreSQL clusters. You can now protect AlloyDB for PostgreSQL clusters against regional outages by storing backups in a distinct secondary region of your choice. To learn more, see Backup vaults for immutable and indelible backups.
BigQuery - BigQuery now supports TabFM, Google's pre-trained foundation model for tabular data. TabFM enables zero-shot regression and classification through in-context learning. It delivers high-accuracy predictions on structured data without requiring model training or hyperparameter tuning. You can use TabFM directly through the AI.PREDICT function and evaluate model performance by using the AI.EVALUATE function. This feature is in Preview. You can now create, store, and manage pipelines in Git folders. This feature is in Preview. You can now create an identity column, sometimes referred to as an auto-incrementing column, on a table. You can use identity columns to create and maintain primary keys on your tables. When you insert a row into a table that has an identity column, BigQuery generates a unique integer value for that column. This feature is in Preview. Using folders to create, store, and manage pipelines is generally available. BigQuery Graph is generally available (GA). BigQuery Graph now includes support for the CALL graph query statement, and the following path inspection GQL functions: IS_ACYCLIC IS_SIMPLE IS_TRAIL. Support for configuring daily token quotas for BigQuery generative AI functions has been restored. The Rust SDK for BigQuery is now in Preview. An updated version of the Simba JDBC driver for BigQuery is now available. Conversational analytics now supports questions about market basket analysis. This feature is generally available (GA).
Bigtable - You can use the Google Cloud console to create and manage aggregate column families for your Bigtable tables. You can also view and query aggregate column families in Bigtable Studio. This feature is generally available (GA). For more information, see Create and manage tables and Manage your data using Bigtable Studio.
Billing - Introducing the Incentives page, for tracking spend-based milestone credits, RaMP, and other conditional incentives If you have a custom pricing contract, you might be enrolled in conditional incentives, where you earn credits or discounts for spending specific amounts on Google Cloud. The Incentives page replaces the Spend-based Milestones tab that was located in the Credits page. The Incentives page provides a consolidated and enhanced experience for tracking your progress towards conditional incentives, including spend-based milestone credits and Rapid Migration & Modernization Program (RaMP) credits and discounts. Learn more about tracking conditional incentives.
Chronicle SOAR - Release 6.3.99 is now available for all regions. Reaction triggers This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities. For more information, see Use reaction triggers in playbooks. Case playbooks This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations. For more information, see Case playbooks overview. Release 6.3.100 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - [Spotlight Feature] Customizable schedules for multi-event rules general availability The customizable schedules for multi-event rules feature is now in General Availability (GA). Customizable schedules give security teams granular control and transparency over how multi-event rules execute in Google SecOps, and provide the following capabilities: Configure settlement delays: Set first-run delay offsets (from 1 minute up to 48 hours) to account for log ingestion latency and reduce false negatives. Leverage automated true-up runs: Automatically re-evaluate time windows at 4 hours (and optionally 30 hours for full context enrichment) to capture late-arriving logs. Migrate legacy rules: Upgrade existing custom multi-event rules to customizable schedules directly from the Rules Dashboard. To manage rule schedules with custom IAM roles, make sure your roles include chronicle.rules.modifyRules and chronicle.ruleDeployments.update. Predefined IAM roles include these permissions automatically. For more information, see Configure customized schedules for rules and Understand rule run scheduling. Self-service Bindplane Enterprise license download This feature is currently in Preview for Google Security Operations tenants in the US and EU regions. Google Security Operations Enterprise Plus and Google Unified Security (GUS) customers can now download their Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents. For more information, see Bindplane Enterprise (Google Edition). [Spotlight Feature] Reaction triggers This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities. For more information, see Use reaction triggers in playbooks. [Spotlight Feature] Case playbooks This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations. For more information, see Case playbooks overview.
Cloud Functions - Support for the Go 1.27 runtime is in General Availability (GA).
Cloud Memorystore - You can use client-side metrics to troubleshoot why your application might experience high latency. This feature is generally available.
Cloud Run - Support for the Go 1.27 runtime is in General Availability (GA). Configure Agent Platform features on your Cloud Run services and jobs to securely authenticate AI agents and MCP servers using system-managed Agent Identities. This support also includes automatic registration in the Agent Registry ( Preview ).
Cloud SQL MySQL - Cloud SQL supports Workforce Identity Federation authentication. This lets you authenticate to your Cloud SQL instance using identities from an external identity provider such as Microsoft Active Directory or Okta. For more information, see Workforce Identity Federation authentication.
Cloud SQL Postgres - You can use the pgAudit extension to prevent string literals that might indicate sensitive information, such as passwords and secrets, from appearing in your log query results. This pgAudit extension capability is supported on [PostgreSQL version].R20260712.01_06 or later. For more information, see Audit for PostgreSQL using pgAudit. Cloud SQL supports Workforce Identity Federation authentication. This lets you authenticate to your Cloud SQL instance using identities from an external identity provider such as Microsoft Active Directory or Okta. For more information, see Workforce Identity Federation authentication.
Cloud SQL SQL Server - Cloud SQL for SQL Server now supports connecting to instances with write endpoints using the Cloud SQL Auth Proxy or Cloud SQL language connectors. When you configure the proxy or a language connector with a write endpoint DNS name, connections are redirected automatically to the new primary instance during replica failover or switchover. For more information, see Connect to an instance using a write endpoint.
Cloud Spanner - Spanner supports using the TABLESAMPLE operator in PostgreSQL-dialect databases to select a random sample of a dataset. For more information, see TABLESAMPLE operator. Spanner supports the following PostgreSQL-dialect database operators: ILIKE ( ~~* ) NOT ILIKE (!~~* ) Spanner supports the following PostgreSQL-dialect database functions: pg.ilike pg.not_ilike For more information, see Pattern matching operators and Functions.
Cloud Storage - You can use Storage batch operations to do the following: Select objects dynamically across a project by using Common Expression Language (CEL) filters based on metadata in your Storage Insights datasets, without manual CSV manifests or BigQuery export queries. Target objects across up to 1,000 buckets in a single batch job. Transition objects in bulk to different storage classes. Patch object access control lists (ACLs) in bulk to update or remove permissions. Use dry run to validate job configurations across multiple buckets, and create jobs directly from a dry run to process the same validated objects. For more information, see Storage batch operations overview and Create and manage batch operations jobs.
Cloud Trace - Starting August 31, 2026, you can no longer create or edit trace sinks. Trace sinks were deprecated on February 18, 2026. For more information, see Export trace spans with sinks deprecation. For information about how to analyze your trace data using SQL, see the following documents: Query and analyze traces using Observability Analytics Query a linked BigQuery dataset
Contact Center AI Platform - Full description on the release page
Datastream - You can now create a Datastream stream directly from the overview page of your Cloud SQL instances using the automated flow. For more information, see Create a Cloud SQL stream using the automated flow.
GKE new features - Session affinity support using GCPTrafficDistributionPolicy for GKE Gateway is generally available. This release currently supports single-cluster GKE Gateway load balancers using the following GatewayClasses: gke-l7-rilb gke-l7-regional-external-managed gke-l7-global-external-managed In addition to the session affinity types available in Preview, you can now use the STRONG_COOKIE_AFFINITY type, which provides the most persistent session stickiness among the session affinity types available in Google Cloud Application Load Balancers. The session affinity types require the following minimum GKE versions: CLIENT_IP, HEADER_FIELD, GENERATED_COOKIE, and HTTP_COOKIE: version 1.35.2-gke.1269001 or later STRONG_COOKIE_AFFINITY: version 1.36.3-gke.1767000 or later For more information, see Configure session affinity using GCPTrafficDistributionPolicy. The bare metal machine types from the C3 machine series are now generally available with GKE clusters. You can now provision machine types such as c3-standard-192-metal in Standard mode with any available GKE version. To use these machine types with Autopilot mode, ComputeClasses, and node pool auto-creation, you must specify the exact machine type using a custom ComputeClass and use GKE version 1.35.3-gke.1389000 or later. GKE support for using the c3-standard-*-lssd machine types as Confidential GKE Nodes with Intel TDX is generally available. For more information, see the following: To use this feature with GKE, see Encrypt workload data in-use with Confidential GKE Nodes. To learn more about the feature from Compute Engine, see Confidential VM overview. To see supported configurations, including machine support, see Supported configurations and its "Machine types, CPUs, and zones" section.
Gemini - New subscriptions for Gemini Code Assist can no longer be purchased through the Google Cloud console using billing accounts that don't have an active Gemini Code Assist subscription. Billing accounts that currently have an active Gemini Code Assist subscription are unaffected. For billing accounts that don't have an active Gemini Code Assist subscription, you can obtain a new Gemini Code Assist subscription by contacting Google Cloud sales. For alternative AI developer tools, use Antigravity, which is available through eligible Gemini Enterprise subscriptions and through Gemini Enterprise Agent Platform.
Google Cloud Armor - Cloud Armor managed rulesets protect your backend services and APIs from a wide range of web application threats using threat signatures which are automatically kept up-to-date. For more information, see Managed rules overview. This feature is available in Preview.
Looker - Full details on the release page.
Memorystore for Redis Cluster - You can use access control list (ACL) policies to secure access to your clusters. You can enable fine-grained security by restricting user and service access to specific keys, commands, operations, and Pub/Sub channels. This feature is Generally Available.
Network Connectivity Center - IPv6 dynamic routes support for include and exclude spoke filters for hybrid spokes is available in Preview. Export filters control which subnets or routes a spoke can send to the hub. Import filters control which subnets or routes can be accepted by a spoke from the hub.
Policy Intelligence - The Policy Analyzer MCP server is generally available. To learn about using the Policy Analyzer MCP server to let agents and AI applications analyze and audit IAM configurations, see Use the Policy Analyzer remote MCP server.
Sensitive Data Protection - Sensitive Data Protection content policies are in General Availability. You can use content policies to evaluate content and return an ALLOW or BLOCK verdict based on data sensitivity. For more information about content policies, see the following: Overview of content policies Create and manage content policies Sensitive Data Protection content policies are integrated with Gemini Enterprise. For more information, see the following: Protect sensitive data in sources Protect sensitive data in Gemini Notebook Enterprise sources
Service Extensions - Agent Gateway now supports Service Extensions to evaluate requests and delegate authorization decisions for agent traffic to either Google services or custom authorization services. This feature is generally available (GA). For more information, see Integration with Agent Gateway.
Service Mesh - In-cluster Cloud Service Mesh 1.27 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions. 1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh. You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.30.4 subject to the list of supported features. The following are not supported: Failover Priority support for DNS clusters ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS Multiple CUSTOM external authorization providers per workload The DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES flag For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.30.4-asm.1 uses Envoy v1.38.4-dev. Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in GCP-2026-057.
VPC Service Controls - VPC Service Controls feature (Status: Preview ): VPC Service Controls supports retrieving and updating service perimeters that contain deleted IAM principals. When you enable this feature, you can manage perimeters that contain deleted user, group, or service account identities without triggering the The email address is invalid or non-existent error. For more information, see Supported identities for ingress and egress rules.
Virtual Private Cloud - General Availability: You can create Compute Engine instances that have multiple virtual network interfaces (vNICs) in the same VPC network. For more information, see Multiple network interfaces in the same VPC network.